nva-rabbitxx[.]framer[.]media

This domain, nva-rabbitxx.framer.media, poses a high-risk phishing threat by impersonating Rabby, a cryptocurrency wallet service. Attackers likely used this site to harvest user credentials, private keys, or seed phrases under the guise of a legitimate wallet interface. The site’s infrastructure was designed to deceive users into entering sensitive information, which could lead to unauthorized access to digital assets or financial theft. Given the domain’s specific targeting of Rabby users, individuals familiar with this wallet brand are at elevated risk of exploitation. Analysis indicates this domain was created on February 21, 2026, and registered through CSC Corporate Domains, Inc. It resolves to the IP address 52.223.52.2, hosted on Amazon’s infrastructure (AS16509) in the United States. The domain appears on two security blocklists and is flagged by 17 out of 95 security vendors on VirusTotal, including Google Safe Browsing, which explicitly labels it as phishing. The SSL certificate, issued by Let’s Encrypt (serial number E7), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. The page title, 'Site Not Found | Framer,' suggests the site may have been hastily taken down or masked after detection. If you visited nva-rabbitxx.framer.media or interacted with its content, immediate action is required. First, revoke any wallet permissions or sessions associated with the site and transfer assets to a new, secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to your organization’s security team or a trusted incident response provider. Do not reuse credentials or private keys exposed to this domain, as they may be compromised. Users should also verify the authenticity of any communications claiming to be from Rabby, as attackers may attempt follow-up phishing via email or social engineering.